Implement S3 service assurance and admission checks

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a06ecb-456a-71c2-b41e-0755d336e883

docs/adr/ADR-0004-service-assurance-disclosure.md

@@ -0,0 +1,64 @@
+---
+id: RPLAT-ADR-0004
+title: "ADR-0004 — Disclose unsupported service guarantees and evidence freshness"
+status: accepted
+revision: "1.0"
+owner: railiance-platform
+date: "2026-09-05"
+last_reviewed: "2026-09-05"
+review_interval: 6m
+---
+
+# ADR-0004 — Service assurance disclosure
+
+## Context
+
+The platform has dated backup/restore evidence and three single-instance CNPG
+cells, but no accepted numeric end-to-end availability/RPO/RTO commitments.
+One successful scratch restore is not a recovery guarantee. A successful
+source validator is not current live health. RPF-WP-0036 makes that distinction
+executable and visible to consumers.
+
+## Decision
+
+Publish `assurance/service-records.json` as the S3-owned disclosure of supported
+and unsupported guarantees. Availability, RPO and RTO remain explicitly
+unsupported until the named service/package/consumer owners accept measurable
+targets backed by evidence. This is a platform disclosure decision, not an
+external owner's approval. A consumer requesting a stronger guarantee needs a
+recorded placement/recovery decision before admission. In particular, CNPG on
+one host does not provide host-loss HA; the dependency is S1 host failure
+domains, S2 runtime placement and package-level failover proof.
+
+Use `assurance/service-contract.json` only for local diagnostics: 15-minute
+capture/health age, 36-hour successful backup/upload age, 30-day restore age,
+one-hour ESO refresh age, and 80% connection/memory occupancy for headroom.
+These intentionally conservative defaults expose
+missing evidence; they are neither SLAs nor approvals to install schedules.
+Service-specific cadence and receiver acceptance remain RPF-WP-0036-T03/T04.
+A different legitimate refresh interval needs an explicit service contract,
+not automatic acceptance of an indefinitely stale observation.
+
+## Consequences
+
+The checker distinguishes healthy, stale, missing, unavailable and failed
+samples. It rejects wrong clusters, unknown payload fields and future times.
+Its receipt states `transport: unmonitored` and `guarantees: unsupported`.
+Receipt syntax and freshness validation do not prove the truth of a supplied
+observation or replace a signed native restore receipt. The live collector
+queries only fixed metadata/status fields, a pg_stat_activity count and
+unauthenticated seal status; it cannot fetch Secrets or run backup, restore or
+seal/unseal mutations.
+
+Sources of restore proof remain the owning packages and their existing
+validators. The platform accepts those artifacts after an approved isolated
+exercise; it does not convert old Markdown or example JSON into fresh proof.
+No unattended jobs or Q2 transport are deployed under this decision.
+
+## Alternatives considered
+
+Invent numeric targets from elapsed restore time: rejected because it creates
+an untested promise. Keep all checks waiting for telemetry: rejected because
+safe local diagnostics and unsupported-guarantee disclosure are useful now.
+Treat every source declaration as live: rejected because desired placement
+and actual deployment can diverge.

docs/adr/ADR-0005-demand-gated-stateful-services.md

@@ -0,0 +1,55 @@
+---
+id: RPLAT-ADR-0005
+title: "ADR-0005 — Reuse existing storage and defer unrequested stateful services"
+status: accepted
+revision: "1.0"
+owner: railiance-platform
+date: "2026-09-05"
+last_reviewed: "2026-09-05"
+review_interval: 6m
+---
+
+# ADR-0005 — Demand-gated stateful services
+
+## Context
+
+INTENT includes cache, object storage and messaging. Valkey is gated in the
+Makefile. CNPG already consumes an external governed S3 backup destination.
+`artifact-store` has local/S3 backend code, retention/hold semantics and a
+MinIO/STS assessment; its older SCOPE understates the code. The reviewed
+platform queue has no accepted general cache or messaging consumer request.
+Absence from this queue is not a claim that no future consumer could need one.
+
+## Decision
+
+- Cache: defer shared Valkey deployment. Reopen on a named consumer specifying
+  latency, eviction/durability, isolation, capacity and an operating owner.
+- General object storage: reuse the existing backup destination only for its
+  approved backup scope. Evaluate artifact-store's existing S3 interface for
+  artifact-preservation demand before proposing another gateway or engine.
+  Defer a general platform S3/MinIO service until accepted demand specifies
+  retention, residency, capacity, recovery, credential scope and package owner.
+- Messaging: defer shared broker deployment until a named consumer defines
+  delivery/replay/order guarantees, retention, throughput and recovery needs.
+  Do not replace application-specific queues by assumption.
+
+Review on a new accepted consumer request, a change in existing provider
+capability, or 2027-03-05, whichever comes first. This is an S3 deployment
+posture decision; it assigns no new obligation to potential consumers and
+chooses no vendor or engine. The Q3 fleet-owner question stays with
+railiance-master; local recovery work continues independently.
+
+## Consequences
+
+Keep deploy gates. Any accepted new demand creates a bounded delivery plan
+covering service contract, custody, tenancy, capacity, backup/restore, telemetry,
+package owner, costs and acceptance before provisioning. Existing backup
+credentials are not general artifact credentials. Platform does not take over
+artifact metadata lifecycle or application publication logic.
+
+## Alternatives considered
+
+Deploy Valkey/MinIO/RabbitMQ to satisfy the nouns in INTENT: rejected because
+it adds unsupported operations without an accepted workload. Declare external
+backup S3 a general object service: rejected because its scope and consumer
+contract are narrower.